General

  • Target

    4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14.dll

  • Size

    598KB

  • Sample

    220908-pglzzseef7

  • MD5

    da51dd657868bf4d2924b4398e045b27

  • SHA1

    2eca78e78bdc00e02da0a7328a3c57176cf3c011

  • SHA256

    4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14

  • SHA512

    ca168c81ebec1de5ffdcb9b766af4c4c4ae42e3a0c49e82c04bc8e9b31fdb30594b6df12a7f3ecddf0d73a352326e8ebd3265caae152bf2d67409b5f3759b1e8

  • SSDEEP

    12288:hzF6eBVYHBQ3DvlYuZ+wNvYyujPt5ABJXT+gO:ho1HBuKuj61D4XTK

Malware Config

Extracted

Family

qakbot

Version

403.858

Botnet

snow01

Campaign

1662453469

C2

200.161.62.126:32101

217.165.68.122:993

99.232.140.205:2222

81.131.161.131:2078

89.211.179.14:2222

186.64.87.202:443

197.94.210.133:443

193.3.19.37:443

37.210.148.30:995

200.100.55.252:32101

70.51.153.182:2222

120.150.218.241:995

173.189.167.21:995

24.139.72.117:443

104.34.212.7:32103

47.23.89.61:995

24.55.67.176:443

172.115.177.204:2222

217.165.77.134:995

24.178.196.158:2222

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14.dll

    • Size

      598KB

    • MD5

      da51dd657868bf4d2924b4398e045b27

    • SHA1

      2eca78e78bdc00e02da0a7328a3c57176cf3c011

    • SHA256

      4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14

    • SHA512

      ca168c81ebec1de5ffdcb9b766af4c4c4ae42e3a0c49e82c04bc8e9b31fdb30594b6df12a7f3ecddf0d73a352326e8ebd3265caae152bf2d67409b5f3759b1e8

    • SSDEEP

      12288:hzF6eBVYHBQ3DvlYuZ+wNvYyujPt5ABJXT+gO:ho1HBuKuj61D4XTK

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks